CVE-2025-48996: PSU HAX CMS Unauthorized Information Disclosure via haxPsuUsage API

Critical Vulnerability Information Vulnerability Overview Vulnerability Type: Unauthorized Information Disclosure Impact Scope: PSU HAX CMS site list leaked via the haxPsuUsage API endpoint CVE ID: CVE-2025-48996 Severity: Medium (CVSS v3 Base Score: 5.3/10) Affected and Fixed Versions Affected Versions: Versions prior to the commit on October 30, 2024 Fixed Versions: Versions after the commit on June 2, 2025 Description Summary: A vulnerability in PSU’s deployed HAX CMS allows unauthorized information disclosure. Through the haxPsuUsage API endpoint, any remote unauthenticated user can retrieve a complete list of all websites hosted on PSU’s HAX CMS. When combined with other authorization flaws (such as HAX-3), this could lead to unauthorized content modification or deletion. Details: - The endpoint returns the list of websites on the PSU HAX CMS instance without requiring any authentication or authorization checks. - The root cause lies in the file, which directly exposes the site list without verifying user identity or access level. Impact Information Disclosure: Unauthenticated users can enumerate all sites under the PSU domain. Risk Escalation: When combined with other authorization flaws (e.g., HAX-3), attackers may: - Modify or delete other users’ sites - Access sensitive metadata or credentials - Clone or delete entire sites PoC (Proof of Concept) 1. Open a terminal or browser. 2. Send a GET request to the following endpoint: Summary This vulnerability chain enables low-privileged users to gain full control over any site within the PSU HAX CMS instance, posing a significant risk to content integrity, availability, and confidentiality. It affects hundreds of PSU academic, instructional, and departmental websites.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-48996: PSU HAX CMS Unauthorized Information Disclosure via haxPsuUsage API

More from this source